Why does a directory also have IRP_MJ_WRITE?

Dear all,

We can write data to a file, but we cannot write data to a directory.

However, in my current MiniFilter project, I can catch IRP_MJ_WRITE sent to a directory. That is, in the PreWrite routine, I call FltIsDirectory to check if it is a directory, and the result is true!

Why?

Thanks in advance.

It is possible to attach an alternate data stream to a directory object
in NTFS.

Pete

On 10/15/2013 6:06 AM, xxxxx@gmail.com wrote:

Dear all,

We can write data to a file, but we cannot write data to a directory.

However, in my current MiniFilter project, I can catch IRP_MJ_WRITE sent to a directory. That is, in the PreWrite routine, I call FltIsDirectory to check if it is a directory, and the result is true!

Why?

Thanks in advance.


NTFSD is sponsored by OSR

OSR is hiring!! Info at http://www.osr.com/careers

For our schedule of debugging and file system seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer


Kernel Drivers
Windows File System and Device Driver Consulting
www.KernelDrivers.com
866.263.9295